Free tool
Secure Password Generator
Create strong passwords in one click: random, easy to remember or PIN. They are generated in your browser and are not sent or stored.
Your password
…
Generated in your browser. It is not sent or stored anywhere.
Is it safe to generate passwords here?
It's designed so you don't have to take our word for it: everything happens on your device.
Cryptographic randomness
We use your browser's secure generator (Web Crypto, crypto.getRandomValues), the same one used for encryption keys. We never use Math.random, which is not safe for this.
Nothing leaves your browser
The password is created by this page's code and is not sent to any server or stored. You can check this in the Network tab of your browser's developer tools.
No bias
We pick each character with unbiased sampling and shuffle the result, so no character or position is more likely than another.
How to have truly secure passwords
Long beats complicated
Every extra character multiplies an attacker's effort. A password of 16 to 20 random characters is much harder to crack than a short one with symbols.
A different password for every service
If you reuse a password and a website suffers a breach, attackers will try that same combination on your email, your bank and your social networks.
Use a password manager
Nobody can remember dozens of unique, long passwords. A manager stores them encrypted and fills them in for you; you only have to remember one master password, which should be both memorable and long.
Turn on two-step verification
Even if someone gets your password, they will also need a second factor. Where you can, use an authenticator app or a passkey rather than an SMS.
Mind the clipboard
Paste the password where you need it, save it in your manager and don't leave it copied. Don't send it by email or messaging.
Frequently asked questions
Do you store the passwords I generate?
No. The password is generated in your browser and is not sent to our servers or to third parties. If you close or reload the page, it disappears.
How many characters should a password have?
At least 12; for important accounts, between 16 and 20 or more. With a password manager you don't need to remember it, so you can use a long one.
What is the entropy shown?
It's a measure of how many possible combinations there are: each bit doubles the number of attempts needed. Above roughly 80 bits is considered very strong against brute-force attacks.
Is a random or a memorable password better?
Random is best for the accounts you keep in a manager. Memorable is for the few you have to type or remember, such as your master password or your computer's password.
Why doesn't the password include dictionary words?
Because attackers try dictionaries and common combinations first. A random string or made-up syllables don't appear in them.
Does this tool protect my business?
It's a good first step, but a business's security also depends on backups, updates and training against phishing. If you'd like to review yours, we can help.
Keep improving your business's security
Want to review the security of your website or your business?
Tell us how you work and we'll tell you what to strengthen first, no strings attached.